Forum Discussion
Audit who read an email in a Shared Mailbox
Hi!
I'm trying to find out which user read an email from a shared mailbox and changed its status from 'Unread' to 'Read'.
For this, I am using the following PowerShell command:
Search-MailboxAuditLog -Identity <shared mailbox> -StartDate "2024-09-02T15:00:00" -EndDate "2024-09-05T11:00:00" -ShowDetailsI get results (Create, SendAs, SoftDelete...), all of them of the type 'LogonType=Delegate', but I don't see any event related to reading the email. If I audit a user's mailbox, I see a lot of 'MailItemsAccessed' and 'Update' events, but not when it's a shared mailbox.
How can I audit email readings, especially the first one that changes it from 'Unread' to 'Read'?
Thank you very much! 🙂
Not sure if Microsoft is actually logging these for shared mailboxes, they had some licensing requirements previously IIRC. Tony Redmond probably remembers better 🙂
The funny thing is that most of my shared mailboxes do not even have an Audits folder?!?
